Why does my email pass SPF and still get rejected?

Very often because SPF passed for a different domain than the one the recipient sees. Without alignment, a pass on the envelope domain does nothing for the header domain under DMARC.

Which address do bounces go to?

The envelope sender, which is why bulk platforms set it to an address they process automatically rather than to a human mailbox.

Should I use strict alignment?

Only if you know every sending source uses your exact domain. Strict rejects mail sent through a provider's subdomain, which is how most platforms send on your behalf.

Glossary

Envelope sender

Every email carries two sender addresses. The envelope sender is declared during the SMTP transaction and is where bounces are returned; the header sender is the one displayed to the recipient. They are frequently different, and nothing in the protocol requires them to match. That gap is the single most important thing to understand about email authentication, because SPF authenticates the first and a recipient reads the second.

The two addresses, and who sees which

The envelope sender is given in the SMTP transaction before the message content is transmitted at all. It never appears in what a recipient reads.

The header sender is a line inside the message, and it is the address a mail client displays as the sender.

Bounces go to the envelope sender, which is why bulk senders set it to an address that processes them automatically.

A message sent through a marketing platform typically has the platform's own domain in the envelope and your domain in the header, which is legitimate and is exactly the configuration that confuses an SPF result.

A reply goes to neither by default — it goes to a separate reply-to header where one is present.

Why SPF alone cannot prevent forgery

SPF asks whether the sending server is permitted to send for the envelope domain. That check can pass perfectly while the header shows an entirely different domain.

So a forger can pass SPF with their own domain in the envelope and put yours in the header, which is the address the recipient sees.

That is not a weakness in SPF; it is SPF doing exactly what it was designed to do, which is a narrower job than most people assume.

It is also why a passing SPF result on its own is weak evidence about whether a domain can be impersonated.

The same applies in reverse: a legitimate message can fail SPF because it was relayed, without anything being wrong with the domain.

What alignment adds

DMARC alignment requires the authenticated domain to match the domain a recipient sees, which is the connection SPF does not make.

Under relaxed alignment the two must share a registrable domain, so a subdomain used by a sending platform still aligns.

Under strict alignment they must match exactly, which rejects mail sent through a provider's subdomain even when that provider is legitimate.

DKIM can satisfy alignment independently, which is why a message relayed through a mailing list frequently still authenticates when SPF has broken.

A message passing either SPF or DKIM with alignment passes DMARC. It does not have to pass both.

Where the distinction shows up in practice

A marketing platform sending on your behalf: the envelope carries their domain, the header carries yours, and only DKIM signing with your domain makes it align.

A mailing list that rewrites the envelope sender so bounces return to the list rather than the original author.

A forwarding rule, which relays the message from an address the original SPF record never authorised.

An automated system sending with an empty envelope sender, which is what a bounce message itself uses and which SPF treats specially.

In every one of these, reading only an SPF result leads to the wrong conclusion about whether anything is broken.

How it is observed

DNS records are read: the SPF policy for the domain, the DKIM keys under the conventional selectors, and the DMARC policy including its alignment modes.

The alignment modes published in the DMARC record are reported, because strict and relaxed produce materially different outcomes for the same sending setup.

No message is sent, received or inspected, so no actual envelope sender is ever observed.

Which sending sources really pass alignment is visible only in the DMARC aggregate reports, which arrive over days rather than during a scan.

Frequently asked questions

Why does my email pass SPF and still get rejected?: Very often because SPF passed for a different domain than the one the recipient sees. Without alignment, a pass on the envelope domain does nothing for the header domain under DMARC.
Which address do bounces go to?: The envelope sender, which is why bulk platforms set it to an address they process automatically rather than to a human mailbox.
Should I use strict alignment?: Only if you know every sending source uses your exact domain. Strict rejects mail sent through a provider's subdomain, which is how most platforms send on your behalf.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website